File name:

1.ps1

Full analysis: https://app.any.run/tasks/595626f3-a236-4598-bc77-d320971d27bf
Verdict: Malicious activity
Analysis date: April 29, 2025, 08:52:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
susp-powershell
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (8013), with CRLF line terminators
MD5:

3172B0397DE618CB685320FFF809CDB4

SHA1:

AFC162FA5AAB45C52F9909D5E4FECA80E6AE82BA

SHA256:

076FEF0EE03BF6F0259F000043C8E74ED989AD698A3DF3DDA5D7B45567354846

SSDEEP:

192:bA27hyMeXjOo/2OsW/gncfQLnqpqTjSFU+Gat/QmmSUDYmp1p3gze:tkfX6m2OsW/OVLqqjSFU+GapQmmhMmp1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3240)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3240)
      • powershell.exe (PID: 6392)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6392)

    • Create files in the Startup directory

      • powershell.exe (PID: 6392)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6392)

  • SUSPICIOUS

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 6392)

    • Application launched itself

      • powershell.exe (PID: 6392)

    • The process hides Powershell's copyright startup banner

      • powershell.exe (PID: 6392)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6392)

    • The process hide an interactive prompt from the user

      • powershell.exe (PID: 6392)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Connects to the server without a host name

      • powershell.exe (PID: 6392)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Retrieves command line args for running process (POWERSHELL)

      • powershell.exe (PID: 6392)

    • The process checks if it is being run in the virtual environment

      • powershell.exe (PID: 6392)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6392)

    • Auto-launch of the file from Startup directory

      • powershell.exe (PID: 6392)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Checks proxy server information

      • powershell.exe (PID: 6392)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Found Base64 encoded encryption-related PowerShell classes (YARA)

      • powershell.exe (PID: 6392)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 6392)

    • Found Base64 encoded compression PowerShell classes (YARA)

      • powershell.exe (PID: 6392)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6392)

    • Reads the software policy settings

      • slui.exe (PID: 4892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3240"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Beim Öffnen dieses Dokuments ist ein Fehler aufgetreten ! Bitte aktualisieren Sie Ihre Version.', 'Adobe PDF Reader Fehlercode: cx91293', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Exclamation);Exit C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4892"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5392\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6392"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\1.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6800C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7972C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
8 245
Read events
8 245
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1Z6HCU6NMSOJAWJBT94V.tempbinary
MD5:BE6624CC46A9E420185BDE274803D75E
SHA256:875C8AFF0495C2AC0AB0AB005198A47F7038013C461459D364F25E1A8F250CCD
6392powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_20vtml4g.hzb.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:BE6624CC46A9E420185BDE274803D75E
SHA256:875C8AFF0495C2AC0AB0AB005198A47F7038013C461459D364F25E1A8F250CCD
6392powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5pnncxs2.rfy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3240powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0U1EVB3ZRHAHTTWY88H7.tempbinary
MD5:CE1902FADD1A26D8BA9E5AC5C56A5D7D
SHA256:F1F7E44347B78CA174F1FDA723E1251471FFD33C1676AAA804CF946E67557444
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nxkops00.erh.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2nfsekoo.hyr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3240powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2898FCF0950DFB9CF16A1BF6D3295A3B
SHA256:DF8EEC6DCA9D587BC0B44A1AC206D7E821937408AA19427764DDFECF8140F367
3240powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10cb8f.TMPbinary
MD5:BE6624CC46A9E420185BDE274803D75E
SHA256:875C8AFF0495C2AC0AB0AB005198A47F7038013C461459D364F25E1A8F250CCD
6392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b78a.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
25
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
304
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6392
powershell.exe
GET
200
45.15.162.16:80
http://45.15.162.16/gigant.txt
unknown
—
—
unknown
7492
WmiPrvSE.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6392
powershell.exe
GET
200
83.138.53.186:80
http://83.138.53.186/2.pdf
unknown
—
—
unknown
7492
WmiPrvSE.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
7840
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7840
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.119.249.228:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
5496
MoUsoCoreWorker.exe
40.119.249.228:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
40.119.249.228:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.119.249.228
  • 40.127.240.158
whitelisted
google.com
  • 172.217.17.142
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.20
whitelisted
www.microsoft.com
  • 23.218.209.163
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.2
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
6392
powershell.exe
Misc activity
ET INFO Request for PDF via PowerShell
6392
powershell.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host PDF Request
6392
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info